IBM QRadar

About IBM QRadar Event Fields

The field names listed in the following table are commonly used in IBM QRadar queries. In this table, the column Custom Property identifies the fields that you must create using IBM QRadar Custom Event Properties.

Field	Description	Custom Property?
AccountDomain	Destination host	Yes
category	Low-level category
destinationIP	Destination IP
destinationPort	Destination port number
deviceType	Log source type
"Email Sender"	The email address of the message sender	Yes
file_sha2	The hash of the file, sha256	Yes
"File Hash"	The hash of the file, sh1	Yes
"File Path"	The path of the file	Yes
Filename	The name of the file	Yes
flowInterface	Flow interface
"MD5 Hash"	The hash of the file, md5	Yes
sourceIP	Source IP
sourcePort	Source port number
URL	URL
username	Username associated with an authenticated HTTP(S) connection request

Creating Custom Properties

The following example shows how to use IBM QRadar Custom Event Properties to extract meaningful values from the Squid Proxy events.

Step 1:

Step 2:

Step 3:

In this example, the regular expression (http[s]?://(.+?)["/?:]) is used to extract the AccountDomain field for Squid Web Proxy logs.

IBM QRadar Query Guidelines

When you configure the QRadar log source in Security Analytics, Security Analytics populates the configuration with sample queries. Use the guidelines in this section to modify the sample queries.

Specify the IBM QRadar Field Names

You must modify the sample queries with the names of the fields used in your IBM QRadar instance.

The following is a sample query to event log sources that is provided in the Security Analytics UI:

SELECT LOGSOURCETYPENAME(devicetype) as sourcetype, sourceIP as src, sourcePort as src_port, DestinationIP as dest_ip, destinationPort as dest_port, REPLACEALL(' ', CATEGORYNAME(category), '_') as action, AccountDomain as dest, URL as url, "File Path" as 'file_path', "File Hash" as 'file_hash', username as user, count(*) from events where src!=dest and dest!='127.0.0.1' {exclusions_term} group by sourcetype, src, src_port, dest_ip, dest_port, action, dest, url, file_path, file_hash, user {time_term}}

Assume you do not have AccountDomain but you have a custom property already defined in your QRadar instance called dest_host to store your host/domain information.

When you add your query in the Security Analytics configuration, specify your field names instead of the sample field names, as follows:

SELECT LOGSOURCETYPENAME(devicetype) as sourcetype, sourceIP as src, sourcePort as src_port, DestinationIP as dest_ip, destinationPort as dest_port, REPLACEALL(' ', CATEGORYNAME(category), '_') as action, dest_host as dest, URL as url, "File Path" as 'file_path', "File Hash" as 'file_hash', username as user, count(*) from events where src!=dest and dest!='127.0.0.1' {exclusions_term} group by sourcetype, src, src_port, dest_ip, dest_port, action, dest, url, file_path, file_hash, user {time_term}

The following is an example of a query to a QRadar flow interface source:

Filter Unnecessary Logs

You can add where conditions to filter logs that do not need to be examined in Security Analytics. In the following example, the where clause filters logs having deny actions.

SELECT LOGSOURCETYPENAME(devicetype) as sourcetype, sourceIP as src, sourcePort as src_port, DestinationIP as dest, username as user, destinationPort as dest_port, REPLACEALL(' ', CATEGORYNAME(category), '_') as action, count(*) from events where action not ilike '%Deny%' and action not ilike '%Denied%' and action not ilike '%deny$' and url is null and src!=dest and dest!='127.0.0.1' {exclusions_term} group by sourcetype, src, src_port, user, dest, dest_port, action {time_term}

Step 1: Create the Security Analytics Log Source Configuration

1. Click the Settings icon in the left navigation panel and select Security Analytics.

2. Click Links.

3. Locate the Universal Link configuration for which you want to add a log source and click the hyperlink name in the Name column. The Link must be online.

   

4. Click the Available tab to display the log source types available. The set of available log source types are different for Cloud Link and Universal Link deployed on premises.

   

5. Click the IBM QRadar icon.

6. Configure the settings described in the following table.

   Setting	Description
   Data Source Name	Type a name that facilitates Link management. Only ASCII characters are allowed.
   Data Source Description	(Optional) A short description for the log source.
   QRadar URL	The IP address or FQDN part of the URL for the QRadar instance.
   QRadar API Version	API Version number. Version 12.0, 11.0, 10.0, and 8.0 are supported. The default is 12.0.
   Authentication Token	Authentication token for the connection to the QRadar instance.
   Use Proxy	Not applicable for Security Analytics.

7. Click Next.

8. Enter your query string in the Search Query 1 field to define what data is to be retrieved from the log source. See IBM QRadar Query Guidelines.

   Click the Plus icon () to add another query for the same table.

9. Enter Interval Schedule, the time between each query run. Default is 10 minutes.

10. Optional: Click Backfill Enable and specify a backfill period if you want to ingest event logs from a period before the log source was activated.

11. Click to expand Drilldown Settings and specify drilldown settings.

    Drilldown Field Mappings	Specify mappings in JSON format. For example: { "event.sourcetype": "LOGSOURCETYPENAME(devicetype)", "event.src_ip": "sourceip", "event.src_port": "sourceport", "event.dest_port": "destinationport", "event.dest_ip": "destinationip", "eventname": "LOGSOURCETYPENAME(devicetype)" }
    Drilldown Limit	Number of rows to be returned by drilldowns. The default is 10 rows.

12. Click Save.

Step 2: Activate the Security Analytics Log Source Configuration

By default, a newly-added data source is not active.

To activate a log source:

1. Click the Settings icon in the left navigation panel and select Security Analytics.

2. Click Links.

3. Locate the Link configuration you want to review and click the hyperlink name in the Name column.

4. Locate the log source you want to activate and toggle the activation switch shown in the following figure.

   

   With this log source type, the associated Link configuration does not need to be regenerated.

Step 3: Verify Logs Are Ingested into Security Analytics

You can expect logs to be transmitted to Security Analytics shortly after the log source has been activated and the Universal Link regenerated.

To verify logs are ingested:

1. Click the Settings icon in the left navigation panel and select Security Analytics.

2. Click Links.

3. Click the hyperlink in the Name column for the Universal Link associated with the log source.

4. Review the timestamp for the last data received and the number of events in the last batch of data to confirm event logs are ingested as expected.